motrice.ind.br
Open in
urlscan Pro
2606:4700:3033::681c:1c0f
Malicious Activity!
Public Scan
Effective URL: https://motrice.ind.br/iti/
Submission: On November 28 via automatic, source openphish
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 7th 2020. Valid for: a year.
This is the only time motrice.ind.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 67.23.244.66 67.23.244.66 | 33182 (DIMENOC) (DIMENOC) | |
9 | 2606:4700:303... 2606:4700:3033::681c:1c0f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 2 |
ASN33182 (DIMENOC, US)
PTR: rbr46.dizinc.com
jrhidreli.com.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
motrice.ind.br
motrice.ind.br |
82 KB |
2 |
jrhidreli.com.br
2 redirects
jrhidreli.com.br |
556 B |
1 |
googleapis.com
fonts.googleapis.com |
521 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
9 | motrice.ind.br |
motrice.ind.br
|
2 | jrhidreli.com.br | 2 redirects |
1 | fonts.googleapis.com |
motrice.ind.br
|
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-07 - 2021-08-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://motrice.ind.br/iti/
Frame ID: 176924830B1F3675670AC1E4BB93BFF9
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://jrhidreli.com.br/itau
HTTP 301
http://jrhidreli.com.br/itau/ HTTP 302
https://motrice.ind.br/iti/ Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://jrhidreli.com.br/itau
HTTP 301
http://jrhidreli.com.br/itau/ HTTP 302
https://motrice.ind.br/iti/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
motrice.ind.br/iti/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
motrice.ind.br/iti/css/ |
193 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stylersheet.css
motrice.ind.br/iti/css/ |
1 KB 717 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-vv.min.js
motrice.ind.br/iti/js/ |
30 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.js
motrice.ind.br/iti/js/ |
904 B 639 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rumum.png
motrice.ind.br/iti/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
motrice.ind.br/iti/js/ |
37 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.js
motrice.ind.br/iti/js/ |
132 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
1 KB 521 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
motrice.ind.br/iti/img/ |
335 B 631 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| validar_index function| preenche function| formatar function| Popper object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.motrice.ind.br/ | Name: __cfduid Value: dba75fd8f0e84faf0ce2518935d0193f81606527279 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
jrhidreli.com.br
motrice.ind.br
2606:4700:3033::681c:1c0f
2a00:1450:4001:809::200a
67.23.244.66
038ecec312ff9c0374c9d8831534865fb7ed6df4c94ca822274cea0ae4cf0e1e
0c489fc6a4d1005640a88bfc3f670615236d9a28f2d024a309a5967502be49ac
30b71b8b4a73e08012b163e830bad0017896dee940601a8a69e870b3c319802a
44fd870deaf70a10e7f3be8a3782bb394be1955b5ff186bdbb5b94a23810e1fa
6bc21e325f9e92c5571194ff99852960f3e85876f69aaf05579c1e83ea2a0422
a3afcd86be949c3028f35cb48142e866b149ae061c93a9645b29e678bfa05928
b6f83c78b3f0a679fd3874967a87373d2c0b57601e40654d9b40e0d94cb59437
ba3422f7601e3c5a2cd2a02c2cde92f6e035e7ab32dd1b3986c3bd12ac4e6c39
c1248219ca6786240698ed716ceb50eac132061c2dc7ebe97f4baecac53f3153
eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f